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Abstract 

We study quantum algorithms for testing bipartiteness and expansion of bounded-degree 
graphs. We give quantum algorithms that solve these problems in time (^(iV 1 / 3 ). beating the 
Q(y/~N) classical lower bound. For testing expansion, we also prove an ^(iV 1 / 4 ) quantum query 
lower bound, thus ruling out the possibility of an exponential quantum speedup. Our quantum 
algorithms follow from a combination of classical property testing techniques due to Goldreich 
and Ron, derandomization, and the quantum algorithm for element distinctness. The quan- 
tum lower bound is obtained by the polynomial method, using novel algebraic techniques and 
combinatorial analysis to accommodate the graph structure. 

1 Introduction 

In property testing, one is asked to distinguish between objects that satisfy a property P and objects 
that are far from satisfying P. The goal is to design algorithms that test properties in sublinear or 
even constant time, without reading the entire input — a task that is nontrivial even for properties 
that can be computed in polynomial time. This is motivated by the practical question of how to 
extract meaningful information from massive data sets that are too large to fit in a single computer's 
memory and can only be handled in small pieces. 

Testing properties of graphs is an interesting special case. 1 Many graph properties, such as 
connectivity and planarity, can be tested in constant time, independent of the number of vertices 
N [18, 21]. However, some graph properties are much harder to test. For bounded-degree graphs 
in the adjacency-list representation, the best classical algorithms for testing bipartiteness [19] and 
expansion [20, 15, 24, 28] use 0(y~N) queries. 2 In fact, this is nearly optimal, as there are fi(vjV) 
query lower bounds for both problems [21]. As a natural extension, we consider whether these 
problems can be solved more efficiently using quantum queries. 

There has been some previous work on quantum property testing. In particular, there are 
examples of exponential separations between quantum and classical property testing [11], and 
there are quantum algorithms for testing juntas [8], solvability of black-box groups [23], uniformity 
and orthogonality of distributions [12, 13], and certain properties related to the Fourier transform 
[2, 13]. However, aside from concurrent work on testing graph isomorphism [13], we are not aware 
of previous work on quantum algorithms for testing properties of graphs. 3 
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1 Here, the graph can be specified by an adjacency matrix (suitable for dense graphs) or by a collection of adjacency 
lists (for bounded-degree graphs) . 

2 We use tilde notation to suppress logarithmic factors. 

3 Quantum speedups are known for deciding certain graph properties, without the promise that the graph either 
has the property or is far from having it [16, 25, 14]. This turns out to be a fairly different setting, and the results 
there are not directly comparable to ours. 
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Here, we give quantum algorithms for testing bipartiteness and expansion of bounded-degree 
graphs in time only (^(N 1 / 3 ), beating the f2(\/iV) classical lower bounds [21]. Moreover, we prove 
that any quantum algorithm for testing expansion must use ^(iV 1 / 4 ) queries, showing that quantum 
computers cannot achieve a super polynomial speedup for this problem. 

Why might quantum computers offer an advantage for testing bipartiteness and expansion? 
The classical algorithms for these problems use random walks to explore the graph, so one might 
hope to do better by using quantum walks, which are a powerful tool for searching graphs [31]. In 
fact, our algorithms use quantum walks indirectly. The classical algorithm for testing bipartiteness 
is based on checking whether a pair of short random walks form an odd-length cycle in the graph, 
thereby certifying non-bipartiteness [19]. The algorithm for testing expansion looks for collisions 
between the endpoints of short random walks, with a large number of collisions indicating that the 
walk is not rapidly mixing [20]. In both cases, the property is tested by looking for collisions among 
a set of 0(yN) items. By using the quantum walk algorithm for element distinctness [7, 26] to 
look for these collisions, we can solve the problem using 0(A r1 / 3 ) quantum queries. In addition, we 
show that the above classical algorithms can be derandomized, using 0(log iV)-wise independent 
bits. This yields quantum algorithms that run in time 0{N 1 / 3 ). 

While we have shown a polynomial quantum speedup, one may ask whether an exponential 
speedup is possible. Quantum computers can give at most a polynomial speedup for total functions 
[9], but this limitation does not apply to property testing (and indeed, examples of exponential 
speedup are known [11]). On the other hand, superpolynomial speedup is impossible for symmetric 
functions [3] , even in the case of partial functions such as those arising in property testing. It is an 
interesting question whether exponential speedups are possible for testing graph properties, which 
may have significantly less symmetry. 

Here we prove that testing expansion requires ^(iV 1 / 4 ) quantum queries, thus ruling out the 
possibility of an exponential speedup. We use the polynomial method [9] — specifically, a technique 
of Aaronson based on reduction to a bivariate polynomial [1]. We define a distribution over N- 
vertex graphs with £ connected components (and with another parameter M ~ N), such that 
each component is an expander with high probability. With £ = 1 component, such graphs are 
almost surely expanders, whereas graphs with £ > 2 components are very far from expanders. Our 
main technical contribution is to show that the acceptance probability of any T-query quantum 
algorithm, when presented with this distribution, is well-approximated by a bivariate polynomial 
in M and £ of degree O(TlogT). This requires a somewhat involved calculation of a closed- form 
expression for the acceptance probability as a function of M and £, using algebraic techniques and 
the combinatorics of partitions. Then it follows by known results on polynomial approximation 
that ^(./V 1 / 4 / log N) queries are necessary to test expansion. 

This proof may be of independent interest since there are very few techniques available to prove 
quantum lower bounds for property testing. In particular, the standard quantum adversary method 
[6] is subject to a "property testing barrier" [22]. Furthermore, graph structure makes it difficult 
to apply the polynomial method, so our lower bound for testing expansion requires substantial 
new machinery. These techniques may be applicable to other problems with graph structure. Note 
also that our approach uses very different techniques from the classical lower bounds for testing 
bipartiteness and expansion [21]. 

We are only aware of a few previous lower bounds for quantum property testing: the result 
that not all languages can be tested efficiently [11] (which is nonconstructive, using a counting 
argument), and lower bounds for testing orthogonality and uniformity of distributions [12, 13] and 
for testing graph isomorphism [13] (which follow by reduction from the collision problem). 

Despite this progress, there remain many unanswered questions about quantum testing of graph 
properties. So far, we have been unable to prove a superconstant lower bound for testing bipar- 
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titeness. More generally, is there any graph property testing problem that admits an exponential 
quantum speedup? 

In the remainder of this section, we define the model of quantum property testing. We use 
the adjacency- list model for graphs with bounded (i.e., constant) maximum degree d. A graph 
G = (V, E) is represented by a function fa : V x {1, . . . , d} — > V U {*}, where /g(v, i) returns the 
i th neighbor of v in G, or * if v has fewer than i neighbors. A quantum computer is provided 
with a unitary black box that reversibly computes fa as \v,i,z) t— > \v,i,z © fc(v,i)). The query 
complexity of an algorithm is the number of calls it makes to the black box for fc- 

We say that G is e-far from satisfying a property P if one must change at least end edges of 
G in order to satisfy P. We say that an algorithm e-tests P if it accepts graphs that satisfy P 
with probability at least 2/3, and rejects graphs that are e-far from satisfying P with probability 
at least 2/3. (More generally, we may consider algorithms that determine whether a graph satisfies 
P or is e-far from satisfying a related property P'.) 

We say that a graph G is an a- expander if for every U C V with \U\ < |V|/2, we have 
|<9(?7)| > a\U\, where d(U) is the set of vertices in V — U adjacent to at least one vertex of U. 

2 Quantum Algorithms for Bipartiteness and Expansion 

First, recall the classical algorithm for testing bipartiteness [19]. This algorithm performs T = 
0(l/e) repetitions, where during each repetition it chooses a random starting vertex s, then does 
K = y/~N poly( lo ^ jV ) random walks from s, each of length L = poly( lo ^. jV ), and looks for "collisions" 
where two walks from s reach the same vertex v, one after an even number steps, the other after 
an odd number of steps. 

We derandomize each of the T repetitions separately. Each repetition uses n = O(KLlogd) 
bits of randomness. We claim that it suffices to use fc-wise independent random bits for some 
k = O(Llogd). To see this, consider the analysis given in [19]. Lemma 4.5 of [19] states sufficient 
conditions for the algorithm to find an odd cycle, and hence reject, with high probability. The proof 
considers the random variable X = Yli<j ^i' wnere Vij i s a Boolean random variable that indicates 
whether walk i collides with walk j while having different parity. The probability that X = is 
upper bounded using Chebyshev's inequality together with bounds on E[X] and VarLY]. Note that 
ELY] and VarLY] are linear and quadratic in the rjij, respectively, so they only depend on sets of at 
most 0(L log d) random bits. Thus they are unchanged by substituting /s-wise independent random 
bits for some k = O(Llogd). This reduces the number of random bits required by the algorithm 
to O(ATogn) = O(poly( logjv £ logd )). 

We then combine this derandomized classical algorithm with Ambainis' quantum algorithm for 
element distinctness [7, 26, 34]. (For details, see Appendix A.) This shows 

Theorem 1. There is a quantum algorithm that always returns "true" when G is bipartite, returns 
"false" with constant probability when G is e-far from bipartite, and runs in time 0{N 1 ^ poly( logAf )) 

Using similar ideas, we can also give an 0(iV 1//3 )-time quantum algorithm for testing expansion. 
We start with the classical algorithm of [20], derandomize it using fc-wise independent random 
variables, and apply the quantum algorithm for element distinctness. There is a slight complication, 
because we need to count collisions, not just detect them. However, the number of collisions is 
small — roughly 0(N 2)1 ) where n is chosen to be a small constant — so we can count the collisions 
using brute force. See Appendix B for details. 



3 



3 Quantum Lower Bound for Testing Expansion 



3.1 Overview 

We now turn to lower bounds for testing expansion. Specifically, we prove 

Theorem 2. Any quantum algorithm for testing expansion of bounded- degree graphs must use 
O^ 1 / 4 / log N) queries. 

Proof. We consider random graphs G on N vertices, sampled from the following distribution Pm,i 
(where M > N and I divides M): 

1. We start by constructing a random graph G' on M vertices, as follows: First, we partition 
the vertices into I sets Vx, . . . , V, with each set Vi containing M/l vertices. Then, on each set 
Vi, we create a random subgraph by randomly choosing c perfect matchings on Vi and taking 
their union. (Here c is some sufficiently large constant.) 

2. We then construct G as follows: First, we pick a subset of vertices vi,. . . ,vn from G' . To 
pick vi, we choose one of the sets V\, . . . , Vi uniformly at random, call it Vj, and we let v\ be 
a random vertex from Vj . For each subsequent vertex Vi , we again select a set Vj uniformly at 
random, and choose Vi uniformly at random among those vertices of Vj that were not chosen 
in the previous steps. Then we let G be the induced subgraph of G' on v\, . . . , ujv- 

The process above fails if we try to choose more than M/l vertices from the same Vj. However, 
the probability of that happening is small — on average, N/l vertices are chosen in each Vj. We 
choose M = (1 + ©(iV" ' 1 )).^. Then a straightforward application of Chernoff bounds implies that 
the process fails with probability at most e - n ( N °' 5j ) . p r more detail, see Section C.l. 

Note that the resulting graph G has degree at most c. The reason for choosing G as a subgraph 
of G' (rather than constructing G directly) is that this leads to simpler formulas for the probabilities 
of certain events, e.g., the probability that vertices v\, t>2 and U3 all belong to the same component 
of G is l/l 2 . This seems essential for our use of the polynomial method. 

If I = 1, then this process generates an expander with high probability. It is well known 
[30, 27] that the graph on M vertices generated by taking c perfect matchings is an expander with 
high probability. In Section C.2, we show that the subgraph that we choose is also an expander. 
(Informally, the main reason is that only a ©(iV" 1 / 4 ) fraction of the vertices of G 1 are not included 
in G. This allows us to carry out the proof of [30, 27] without substantial changes.) 

If / = 2, then this process generates a disconnected graph with two connected components, each 
of size roughly N/2. Such a graph is very far from any expander graph — specifically, for any a', it 
is at least about (a'/2d)-far from an a'-expander of maximum degree d. 

Therefore, if a quantum algorithm tests expansion, it must accept a random graph generated 
according to Pm,i with probability at least 2/3, and a random graph generated according to Pmi 
with probability at most 1/3. (Graphs drawn from Pm,i with I > 2 must also be accepted with 
probability at most 1/3, although this fact is not used in the analysis.) 

The strategy of the proof is as follows. We show that for any quantum algorithm run on 
a random graph from the distribution Pm,u the acceptance probability of the algorithm can be 
approximated by a bivariate polynomial in M and Z, where the number of queries used by the 
algorithm corresponds to the degree of this polynomial. (This is our main technical contribution.) 
We then lower bound the degree of this polynomial. 

In more detail, we will prove the following lemma (see Section 3.2): 
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Lemma 3. Let A be a quantum algorithm using T queries. The acceptance probability of A (for the 
probability distribution Pm,i) is approximated (up to an additive error of e~ a ( N ° ' j5 )j by a fraction 
g(M'fy > where f(M,l) and g(M,l) are polynomials of degree 0(T\ogT) and g(M,l) is a product of 
factors (M — (2k — 1)1) for k G {1, . . . , T}, with (M — (2k — 1)1) occurring at most 2T/k times. 

Now choose a = 1 + Q(N~ 0,1 ) such that aN is even. We say that a pair (M,l) is 5-good if 
M e[aN - 5 3 / 2 , aN + 2 }, I < 5, and I divides M. 

We then approximate the fraction ^fjy (from Lemma 3) by ( a ^dff g(M,o • For each term M — 
(2k — 1)1, we first replace it by M and then by aN. The first step introduces multiplicative error 
of 1 — ^ 2k k p l > 1 — ~ e~ 2kl l N . For all terms together, the error introduced in this step is at 
most Uk=i( e ~ 2kl/N ) 2T/k = e~ 4T2l / N . If T = 0(N 1 / 4 / log N) and I = 0(N 1 ' 2 ), the multiplicative 
error is 1 — o(l). 

The second approximation step introduces multiplicative error of 

^M_^0(TlogT) ^ ^ e (M-aN)/aN ^O(TlogT) < ^<5 3 / 2 /aN ^O(TlogT) 

If 5 = 0(N 1 / 2 ) and T = 0(N 1 / 4 /logN), this can be upper bounded by 1 + e for arbitrarily small 
e > 0, by appropriately choosing the big-0 constant in T = 0(N 1 / A /log N). 

Next, we prove a second lemma, which lower bounds the degree of a bivariate polynomial: 

Lemma 4. Let f(M,l) be a polynomial such that \ f(aN, 1) — f(aN,2)\ > e for some fixed e > 
and, for any 5-good (M,l), \ f(M,l)\ < 1. Then the degree of f(M,l) is 0.(^/6). 

The proof of this lemma follows the collision lower bounds of Aaronson and Shi [1, 32] and is 
included in Section C.3 for completeness. 

We now set 5 = Q(N 1 / 2 ) and apply Lemma 4 to 2 ^ a ^dIgg(M,i) ■ This is a polynomial in M 
and t, because the denominator is a constant. With M = aN, its values at Z = 1 and / = 2 are 
bounded away from each other by at least 1/3 since the algorithm works. Its values at <5-good pairs 
(M,l) have magnitude at most 1 because the acceptance probability of the algorithm is in [0,1], 

SO I 2 (ajfflg 9(A/,l) I ^ 1 + TllUS We filld that the de § ree ° f /( M >0 must be ^(N 1 / 4 ). It follows 

that T = il(iV 1//4 /log N) queries are necessary. □ 



3.2 Proof of Lemma 3 

Here we assume that the process generating a graph G from the probability distribution Pm,i does 
not fail. (The effect of this process possibly failing is considered in Section C.l.) The acceptance 
probability of A is a polynomial Pa of degree at most 2T in Boolean variables x u ,v,j, where x U)V j = 1 
iff (u, v) is an edge in the j th matching. 

Pa is a weighted sum of monomials. It suffices to show that the expectation of every such 
monomial has the rational form described in Lemma 3. If this is shown, then E[P J 4] is a sum of 
such fractions: E[Pa] = ^ + + • • • . We put these fractions over a common denominator, 

obtaining E[P^] = where g(M, I) = lcm(<7i(M, l),g2(M, I), . . .). In this common denominator, 

(M — (2k — 1)1) occurs at most 2T/k times. Therefore, the degree of g(M, I) is at most 2T Y^k=i \ = 
O(TlogT). Similarly, the degree of f(M, I) is at most 0(T log T) + deg g(M, I) = O(TlogT). 

Now consider a particular monomial P = x Uim j 1 x U2iV2 j 2 ■ ■ ■ x Ud:Vd j d , where d = deg P. Let Gp 
be the graph with edges (u\,v\), . . . , (ud,Vd) (i.e., with the edges relevant to P) where the edge 
(ua,v a ) comes from the j a h matching. Let C\,...,Ck be the connected components of Gp. For 
each component C{, let Xi be the event that every edge (u a ,v a ) in Cj (viewed as a subgraph of 
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Gp) is present in the random graph G as part of the matching. We have to find an expression 
for the expectation 

e[p] =Pr[Xinx 2 n...nx fc ]. 

We first consider Pr[Xj]. Let Vi be the number of vertices in Cj, and for each matching j, let 
dy be the number of variables x U] „j in P that have u,v G Cj and label j. Note that 

+ d it2 H h di, c > «i - 1 (1) 

because a connected graph with Vi vertices must have at least v i — 1 edges. We have 

^ c j 1 c / 

Here i - ^ -1 ) is the probability that all vertices are put into the same set Vj (for some 1 < 
j < (which is a necessary condition for having edges among them), and n_j'=i M/i-(2j'-i) ^ s ^ e 
probability that dij particular edges from the j th matching are present. (For the first edge (u, v) in 
the j th matching, the probability that it is present is , since u is equally likely to be matched 

with any of M/l vertices in Vj except for u itself; for the second edge (u',v') in the j th matching, 
the probability that it is present is M ^_ 3 , since u' can be matched with any of M/l vertices except 
u,v,u'; and so on. Note that without loss of generality, we can assume that the edges in P from 
the j th matching are distinct. If P contains the same edge twice from the same matching, then we 
can remove one of the duplicates without changing the value of P.) 
We can rewrite (2) as PrpQ] = YYj=i R-diji where we define 

We now extend this to deal with multiple components Cj at once, i.e., we want to evaluate 
Pr [P|j e s Xi], where S C {1, . . . , k}. Let Es be the event that the vertices in [j ieS Ci (i.e., in any of 
the components indicated by S) are all put into one set Vj. Then Pr [Plies ^Ql-^s] = 0^=i ^E lG s rf » i ' 
The event Es happens with probability l~(£*ies v i)+ 1 j since the total number of vertices in UieS^ 

Let L = (Si, . . . , St) be a partition of {1,2,..., k}. We call S±, . . . ,St classes of the partition 
L. We say that S € L if S is one of Si, . . . , St- Let \L\ = t. We say that L is a refinement of 
V (denoted L < L') if L can be obtained from V by splitting some of the classes of V into two 
or more parts. We write L < V if L < V or L = L' . When L < L' , let cl u be the number of 
sequences L = L$ < L\ < ■ ■ ■ < Lj = V , with sequences of even length j counting as +1 and 
sequences of odd length j counting as —1. We define c^ y = 1 when L = L' . We have the following 
partition identity, which will be useful later; the proof is given in Section C.4. 

Proposition 5. Suppose L" < L. Then Ylu- l"<L'<l c L',l = 0. 

We define the expressions 



fL(M,l)=UU R ^s^ W 

S£Lj=l 

f' L (M,l)= Yl CLi,Lh>(M,l). (5) 



V: L'<L 
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We can now evaluate Pr[Xi n Xi Pi ... Pi Xk] as follows. For any partition L of {1, 2, . . . , k}, let 
El be the event Hsgl ^s- Let E' L be the event that El happens but no with L < V happens 
(i.e., L is the least refined partition that describes the event). Then 

Pr[Xi nx 2 n...nx k ] = Y, Pr[E' L ]f L (M, I). 

L 

By inclusion-exclusion, Pr[£^J = l<L' °l,L' P^[El']- Now substitute into the previous equa- 
tion, reorder the sums, and use the definition of f' L (M,l): 

Pr[X 1 nX 2 n...nX fe ]=^Pr[£ I/ ] c L ^f L (M,l) = Y,^[E L }f' L (M,l). 

V L: L<L' L 

Note that Pr[£ L ] = \\ SeL Yi[E s ] = \\ SeL l~^es = p(£i=i^)+|£|. Thus we have 

PrpTx ni 2 n...m t ] = 5] rCEt^+W/j. (Mj z) . (6) 

L 

We have now written Pr[Xi n -X2 Pi ... PI JT^] as a sum of rational functions of M and Z. We can 
combine these into a single fraction jfj^jj- It remains to show that this fraction has the properties 
claimed in Lemma 3. 

First, we claim that the denominator g(M,l) contains at most 2T/k factors of M — {2k — 1)1. 
Observe that each fi(M, I) is a fraction whose denominator consists of factors M — (2k — 1)1. The 
number of factors in the denominator is equal to the number of variables in the monomial P, which 
is at most 2T. By the form of (3), for each M — (2k — 1)1 in the denominator, we also have M — I, 
M — 31, . . ., M — (2k — 3)1 in the denominator. Therefore, if we have t factors of M — (2k — 1)1 
in the denominator, then the total degree of the denominator is at least tk. Since tk < 2T, we 
have t < IT Ik. This statement holds for fi(M,l) for every L. Thus, when we sum the /l(M,1) 
to obtain first f' L (M, I) and then Prpfi Pi X2 Pi ... Pi Xk], and put all the terms over a common 
denominator g(M,l), this statement also holds for g(M,l). 

In Prpfi nl 2 n...n Xk], when we sum the f L (M, I) in (6), we also have factors of /E l= i Vi)-\L\ 
in the denominator. Proposition 6 shows that these factors are cancelled out by corresponding 
factors in the numerator. 

Proposition 6. f' L (M,l) is equal to a fraction whose denominator is a product of factors (M — 
(2k — 1)1) and whose numerator is divisible by Z(E=i V i)-\ L \ _ 

When we combine the different f' L (M,l) in (6) into a single fraction ^fnj> we see that / and 
g have the desired form. Also note that / and g have degree 0(T log T), by repeating the same 
argument used earlier to combine the different monomials P. This completes the proof of Lemma 3; 
it remains to show Proposition 6. 

Proof of Proposition 6. Note that contains an obvious factor of l d . We define 

x-,/ _ Rd _ tt 1 

l * ^ M ~ ( 2 f ~ l ) 1 

and we redefine /l(M, I) and f' L (M, I) (equations (4) and (5)) using R' d instead of Rd- This removes 
a factor of l d from the numerator of Rd and a factor of l^ i ^ di ' i from the numerator of fi(M,l). 
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By equation (1), this factor is at least l^i Vi )~ k . Therefore, it remains to show that the numerator 
of the redefined f' L (M,l) is divisible by l k ~\ L \. 

Recall that f' L (M,l) is a sum of terms Jl'(M,1) for all V < L. Let us write each term as 
fi>{M,l) = l/Ilfce-ft'(L / )(-^ ~~ where K(L') is a multiset. We put these terms over a common 
denominator {3l(M, I) = rifceB(L)(-^ — where B(L) D K(L') for all L' < L. Then we have 

f L ,(M,l) = ^^ , a L ,(M,l)= H (M-kl), 



keB(L)-K(L') 



f ' L{M ' l) = f^fy a '^ M ^= E CL', L a L ,(M,l). 



V : L'<L 



Let m = \B(L)\. Also, let m = \K(L')\ = EseL' Ej=i Ei G 5 d i,j = Ei=i Ey=i d i,j> which is 
independent of L'. Let m! = \B{L) — K(L')\ = m — rh, which depends on L but not on V . 

We want to show that a' L (M, I) is divisible by First, we multiply out each term ai/(M, I) 

to get a L i(M,l) = YT=o e i( B ( L ) ~ K(L'))M m , where e, is the i th elementary symmet- 
ric polynomial (i.e., ei{B{L) — K(L')) is the sum of all products of i variables chosen without 
replacement from the multiset B(L) — K{L')). We can then write a' L (M, I) as 

m' 

a' L {M,l) = Y J 0L, l M m '-\-l)\ e L>i = Yl cv,Lei{B{L)-K{L')). 

i=0 L':L'<L 

It suffices to show that, for all < i < k — \L\ — 1, the coefficient Ol^ is 0. Note that if L is the 
finest possible partition L*, then \L\ = k and the above claim is vacuous, so we can assume that 
L* < L. Also note that 9l.o = by Proposition 5 with L" = L*, so it suffices to consider i > 0. 

For any set of variables E and any a > 0, define the power-sum polynomial T a (E) = X^fceE 
We can write ei(B(L) — K(L')) in terms of power sums: 

ei(B{L) - K(L')) = A i>L [T a (B(L) - K(L')) : a = 0, 1, 2, . . . 

where A^l is a polynomial function of the power sums T a (B(L) — K(L')) of total degree i in the 
variables k € B(L) — K(L'). Note that the polynomial A^i only depends on the size of the set 
B(L) — K(L'), hence it only depends on L, and not on L' . To simplify things, we can write 
T a (B(L) — K(L')) = T a (B(L)) —T a (K(L')) and absorb the T a (B(L)) term into the polynomial A i|L 
to get a new polynomial A^x,. Then we have ei(B(L) — K(L')) = A^x [T a (K(L')) : a = 0, 1, 2, . . . , i], 
and 

dL,i= Yl c L ^ L k hL [T a {K{L')): a = 0,1,2,...,*]. 

L' : L'<L 

It suffices to show that, for all < i < k — \L\ — 1, the above sum vanishes term-by-term, i.e., for 
all sequences {aj} such that aj > and Y2j a j — *\ we have 

£ c L ,, L Y[T aj (K(L>)) = 0. (7) 

L':L'<L j 

We have T a (K(L')) = £ 5ei , £j=i T ({1, 3, 5, ... , 2(£ ieS djj)- 1}), by the definition of K(L'). 
Note that, for any integer s, T a ({l, 3, 5, . . . , 2s - 1}) = T a ({l, 2, 3, ... , 2s}) - 2 a T a ({l, 2,3,..., s}), 
and by Faulhaber's formula, this equals a polynomial Q a (s) of degree a+1, with rational coefficients 



S 



and no constant term. We have T a (K(L')) = J2seL' Yfj=\ Qa(52ies dij)- Let q a , a (a = 1, . . . , a+1) 
be the coefficients of Q a . Then we can rewrite this as 

a+l c 

T a (K(L')) = Y,1a,aS a (L'), where S a (L f ) = ^ ^(E^)"" 
a=i seL> j=i ies 

It suffices to show that the sum in equation (7) vanishes term-by-term, i.e., for all < i < k — \L\ — 1 
and for all sequences {ctj} such that aj > 1 and J2j( a j ~ 1) — h we have 

L':L'<L j 

This final claim is shown by Proposition 19 in Section C.5. This completes the proof of Proposition 6. 

□ 
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for % = 1, . . . ,K where K = v / iVpoly(M) do 

Starting from s, take a random walk of length L = poly( og ), with steps chosen as follows: 
At vertex v, for each adjacent vertex u, move to u with probability stay at v with 
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Let (^ij)j=o,i,2,... be the sequence of vertices visited during the walk, omitting consecutive 
repetitions of the same vertex (i.e., when the walk stays at the same vertex for more than 
one time step, only include that vertex once in the sequence, so Wij / tt^y+i)) 
end for 

if = Wi'ji for some i,j,i',j', where j is even and j' is odd then 
return "false" 

end if 
end for 
return "true" 
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A Quantum algorithm for testing bipartiteness 
A.l Derandomization 

We recall the classical algorithm for testing bipartiteness [19]. This is based on the fact that a 
bipartite graph contains no cycles of odd length, whereas if a graph is far from bipartite, then 
it contains many short odd cycles. The algorithm tries to find an odd cycle by running several 
random walks from a common starting vertex s and looking for "collisions" where two walks reach 
the same vertex v, one after an even number steps, the other after an odd number of steps. More 
precisely, the algorithm performs T = 0(l/e) repetitions, where during each repetition it chooses 
a random starting vertex s, then does K = yJ~N poly( og £ ) random walks from s, each of length 
L = poly( log ). See Algorithm 1 for a precise description. 
This algorithm has the following performance guarantees: 
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Theorem 7 (Theorem 2 in [19]). Algorithm 1 always returns "true" when G is bipartite and returns 
"false" with probability at least 2/3 when G is e- far from bipartite. The algorithm has running time 
poly(\/iV lo | jV ), and in particular, makes polj(\^N log £ N ) queries. 

Our first step is to partially derandomize Algorithm 1 using A:-wise independent random vari- 
ables. 4 Intuitively, this is possible because the algorithm (and the analysis of its performance) only 
depend on the behavior of pairs of random walks, which are determined by subsets of poly(log N) 
random bits. Derandomization reduces the number of random bits from 0(y/~N poly(log iV)) to 
poly (log N), which in turn reduces the running time of our quantum algorithm. 

We use the following simple construction for k- independent random variables: 

Proposition 8 (Proposition 6.5 in [4]). Suppose n + 1 is a power of 2 and k is odd, k < n. Then 
there exists a uniform probability space O = {0, l} m where m = 1 + ^(k — 1) log 2 (n + 1), and there 
exist k-wise independent random variables £i, . . . , £ n over $7, such that Pr[£j = 1] = Pr[£j = 0] = i. 

Furthermore, there exists an algorithm that, given and 1 < j < n, computes £j(i) in time 

O(Hogn). 

Note that even more efficient constructions are possible for random variables that are almost 
fc-wise independent [5], which might facilitate slight improvements to the running times of our 
algorithms. 

We derandomize each of the T repetitions of Algorithm 1 separately. Each repetition uses 
OiKL log d) bits of randomness. 5 We claim that it suffices to use £;-wise independent random bits 
for some k = O(Llogd). To see this, consider the analysis of Algorithm 1 in [19]. It is clear that 
when G is bipartite, the algorithm accepts; the main task is to show that when G is e-far from 
bipartite, the algorithm rejects. The proof establishes the contrapositive: assuming the algorithm 
accepts with probability at least 1/3, one can construct a bipartition of G with few violating edges, 
thus showing that G is e-close to bipartite. 

Lemma 4.5 of [19] states sufficient conditions for the algorithm to find an odd cycle, and hence 
reject, with high probability. The proof considers the random variable X = Yli<j Viji where rjij is a 
Boolean random variable that indicates whether walk i collides with walk j while having different 
parity. The probability that X = is upper bounded using Chebyshev's inequality together with 
bounds on ELY] and VarLY]. In particular, ELY] and VarLY] are bounded in terms of quantities 
that only involve the behavior of a single random walk. (Likewise, the sufficient conditions in 
Lemma 4.5 only involve a single random walk.) Using Lemma 4.5, and the fact that the algorithm 
accepts, one can deduce properties of the graph G. In the remainder of the proof, these properties 
are used to construct a bipartition of G with few violating edges, as desired. 

Note that ELY] and VarLY] are linear and quadratic in the rjij, respectively, so they only 
depend on the behavior of sets of at most 4 random walks. Thus they only depend on sets of at 
most O(Llogd) random bits, so they are unchanged by substituting /c-wise independent random 
bits for some k = O(Llogd). In particular, letting X denote the derandomized version of Y, we 
have ELY] = ELY] and VarLY] = VarLY]. Thus the probability that X = is upper bounded 
using the same argument as above. It follows that we can substitute /c-wise independent random 
variables, constructed using Proposition 8, with n = O(KLlogd) and k = 0{L log d). This reduces 
the number of random bits required by the algorithm to O(klogn) = 0(poly( og £ log )). 

4 We say that a collection of random variables is k-wise independent if any subset of at most k of the variables is 
independent. 

5 This involves a minor technical issue: the random walk chooses uniformly among 2d outcomes, and when d is not 
a power of 2, we have to approximate the desired distribution. This can be handled using standard techniques [4]. 
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Algorithm 2 Testing bipartiteness (quantum) 

Given: Oracle fc specifying a graph G with N vertices and max degree d; accuracy parameter e 
for r = 1, . . . , T for some T = 8(l/e) do 
Pick a random vertex s 

Let K = po \y(^)VN, L = p l y (M) ; n = and fc = 6(L) 

Using Proposition 8, construct fc-wise independent random variables 6y taking values in 

{0, 1, . . . , 2d - 1} (for i = 1, . . . , K and j = 1, . . . , L) 

Let X = {1, ... , If} x {1, . . . , L} and Y = {1, . . . , N} x {0, 1} 

Define /: X — > Y as follows: Given run a random walk in G, starting at s, with random 

coin flips (6ji, ■ ■ ■ ,bij). Let t> be the endpoint of the walk, and let q be the number of steps 
taken in the graph, not counting steps where the random walk chooses to stay at its current 
location. Return (u.gmod 2). 

Define RCY xY such that ((v, c), (v' , c')) G R iff (v = v' and c / d) 

if the algorithm from Theorem 9 finds a collision in R then 
return "false" 

end if 
end for 
return "true" 



A. 2 A quantum algorithm 

We now give a quantum algorithm (Algorithm 2) for testing bipartiteness. The basic idea is to run 
several random walks starting from the same vertex s and solve the element distinctness problem 
to find "collisions" between these walks. We use the following variant of Ambainis's quantum 
algorithm for element distinctness. Let X and Y be finite sets. Suppose we are given oracle access 
to a function / : X — > Y, and let R C Y x Y be a symmetric binary relation that we can compute in 
time poly(log \Y\). We define a collision to be a distinct pair x, x' G X such that (f(x), f(x')) G R. 
The following result gives a quantum algorithm for finding collisions [7, 26, 34]: 

Theorem 9 (Special case of Theorem 3 in [26]). There is a quantum algorithm (with oracle f) 
that finds a collision (with respect to R) with constant probability when a collision exists, always 
returns "false" when there are no collisions, and runs in time 0(\X\ 2 / 3 ■ poly (log \ Y\)). 

In our application, each element of X is a sequence of coin tosses; the function / computes 
the endpoint of the corresponding walk in the graph, together with the number of steps along the 
way; and the relation R tests whether two walks reach the same vertex, one after an even number 
of steps, the other after an odd number of steps. Since we search for collisions among 0(\Z/V) 
elements, we require 0(iV 1//3 ) evaluations of the function /. Moreover, / can be computed using 
only poly( 1 °g Af ) queries, so the quantum algorithm uses 0(N 1 ^ 3 poly( 1 °| Af )) queries. 

It is now clear why derandomizing the classical algorithm is useful: it allows a concise represen- 
tation of the elements of X. Rather than enumerating them explicitly, which would take 0(s/N) 
time, we can describe and manipulate them in time poly( log N ), so the quantum algorithm runs in 
time 0(iV 1 / 3 poly(M)). 

Note that the element distinctness algorithm requires that the function / is computed unitarily 
as Uf. \x)\z) i->- \x)\z © /(%)}■ We have access to the unitary operation Uf G : \v, i)\w) i->- \v, i)\w © 
/g(v, i)) provided by the oracle fc- Since computing / only requires classical operations and queries 
to fc we can perform Uf using reversible classical computation and queries to Uf G . 
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Algorithm 3 Testing expansion (classical) 



Given: Oracle fc specifying a graph G with N vertices and max degree d; accuracy parameter e; 
expansion parameter a; running time parameter \x 
for r = 1, . . . ,T for some T = 6(l/e) do 
Pick a random vertex s 
for i = 1, . . . , K where A" = N 1 / 2 ^ do 

Starting from s, take a random walk of length L = (lQd 2 /a 2 ) log iV (the random walk 
proceeds as follows: at vertex v, for each adjacent vertex u, move to u with probability 
stay at u with probability 1 — de | ^ ) 
Let Wi be the endpoint of the walk 
end for 

Let X be the number of pairwise collisions among the vertices wi, . . . , wk 

Let M = \N 2 ^ + ^N 1 - 7 ^ 

if X > M then 
return "false" 

end if 
end for 
return "true" 



Theorem 10. Algorithm 2 always returns "true" when G is bipartite, returns "false" with constant 
probability when G is e-far from bipartite, and runs in time 0(iW3 po i y (M))_ 

Proof of Theorem 10. When G is bipartite, it has no odd cycles, so Algorithm 2 never finds a 
collision. Thus the algorithm returns "true." 

When G is e-far from bipartite, the analysis of [19] implies that, with constant probability, one 
of the sets of random walks sampled by the algorithm contains a collision. Thus the algorithm 
returns "false." 

For the bound on the running time, note that evaluating the fc-wise independent random 
variables bjj(w) takes time O(klogn) = 0(poly( l0 ^ )). Also, each evaluation of the function 
/ takes time poly( lo | jV ). Since X has size 0(VN poly( lo | Af )), finding a collision takes time 

0(^/3 p ly(M)). □ 

B Quantum algorithm for testing expansion 
B.l Derandomization 

We now turn to the problem of testing expansion. We begin by recalling the classical algorithm for 
this problem, originally due to [20] . The basic idea is to test how rapidly a random walk from some 
starting vertex s converges to the uniform distribution. This can be done by running several random 
walks starting from s and counting the number of collisions among their endpoints — the number of 
collisions is smallest when the distribution is uniform. Here we consider the version of the algorithm 
that appears in [28]. (See Algorithm 3 for details.) This algorithm makes T = 0(l/e) repetitions, 
and during each repetition, it runs K = A rl / 2+M random walks, each of length L = (16d 2 /a 2 ) log N . 
(Here e, \x, d, and a are parameters describing the problem of testing expansion. They play only a 
minor role in the present discussion.) 

This algorithm has the following performance guarantee [28, 24, 15]: 
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Theorem 11 (Theorem 2.1 in [28]). Assume d > 3, < a < 1, and < fj, < \. Algorithm 3 runs 
in time 0{N l / 2+ ^\ogN ■ d 2 /ea 2 ). Furthermore, there exists a constant c > (which depends on 
d) such that, for any < £ < 1: 

1. //G is an a-expander, then the algorithm returns "true" with probability at least 2/3. 

2. If G is e -far from any (c[ia 2 )- expander of degree at most d, then the algorithm returns "false" 
with probability at least 2/3. 

We partially derandomize Algorithm 3 using £>wise independent random variables, with sim- 
ilar motivation and techniques as for testing bipartiteness. Note that the algorithm originally 
requires KL log d = 0{N l / 2+ ^{d 2 / a 2 ) log iV log d) random bits for each of the T repetitions. As for 
bipartiteness, we derandomize each of the repetitions independently. 

To explain how the derandomization works, we recall the proof of Theorem 11 in [28] . Letting rjij 
indicate whether walk i collides with walk j, one must show that the random variable X = X^<j Vij 
is concentrated around its expectation. This is done using Chebyshev's inequality together with 
bounds on ELY] and VarLY]. In particular, it is possible to bound ELY] and Var[Y] in terms of 
quantities that only depend on the behavior of a single random walk. 6 

Note that ELY] and Var[Y] are linear and quadratic in the rjij, respectively, so they only depend 
on correlations among up to 4 random walks. These correlations involve subsets of at most 4Llogd 
random bits. Thus, we can substitute fc-wise independent random bits, where k = 4Llogd. Letting 
X denote the number of collisions in the derandomized algorithm, we have ELY] = ELY] and 
Var[Y] = VarLY]. Thus the proof goes through just as before: the bounds on ELY] and VarLY] 
also imply that X is concentrated around its expectation. Finally, note that the derandomized 
algorithm requires only 0(k log(KL log <i)) = 0((d 2 /a 2 ) log 2 iVlogd) bits of randomness for each 
of the T repetitions. We have reduced the number of random bits from 0(iV 1 / 2+M ) to 0(log 2 N). 

B.2 A quantum algorithm 

We now describe a quantum algorithm for testing expansion. The basic idea is similar to that 
for bipartiteness, with one additional detail: we run several random walks from the same starting 
vertex, then use a quantum algorithm to count the number of collisions among the endpoints of 
the walks. More precisely, we determine whether the number of collisions is greater or less than 
M, for small values of M. We do this by using the algorithm of Theorem 9 to explicitly find up to 
M collisions, one at a time; this takes time polynomial in M. See Algorithm 4, whose performance 
is characterized as follows. 

Lemma 12. Algorithm 4 returns "true" with constant probability if there are M or more collisions, 
always returns "false" if there are strictly fewer than M collisions, and runs in time 0(M log M ■ 
|Y| 2 / 3 -poly(log|Y|)). ' 

Proof of Lemma 12. Suppose there are M or more collisions. Then in each iteration (i = 1, . . . , M), 
there are collisions to be found. Consider what happens in iteration i. Say that the algorithm from 
Theorem 9 returns "false" with probability at most p (some constant). We run that algorithm 
t = log 1( / p (3M) times. The probability that it returns "false" on every attempt is at most p l = 
so the probability that we return "false" during iteration i is at most and by the union bound, 
the probability that we return "false" is at most 1/3. 

The other claims are easy to see. □ 

6 This step occurs in Lemma 3.4 of [28], Lemma 3.1 of [24], Lemma 4.1 of [15], and Lemma 1 of [20]. 
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Algorithm 4 Counting collisions (quantum) 

Given: A set X, an oracle f:X—>Y,a relation R C Y x Y, and a number M 
Initialize 5 = 
for i = 1, . . . , M do 

for j = 1, . . . , i for some t = ©(log M) do 

Run the algorithm of Theorem 9 to find some distinct x,x' £ X such that (f(x), f(x')) G i? 
and (x, a/) ^ 5. 

if the algorithm finds a collision (x, x') then 

set S = Su{(x,x'), (x',x)} 

break out of the inner for loop 
end if 
end for 

if the algorithm did not find a collision on any of the t tries then 
return "false" 

end if 
end for 
return "true" 



Our quantum algorithm for testing expansion is now straightforward; see Algorithm 5. We 
prove the following: 

Theorem 13. Algorithm 5 runs in time 0(N 1 / 3+3fl poly(log N) ■ (d 2 /ea 2 ) log(c£/a)). Furthermore, 
there exists a constant c > (which depends on d) such that, for any < e < 1: 

1. If G is an a- expander, then the algorithm returns "true" with probability at least 2/3. 

2. If G is e- far from any (cfia 2 )- expander of degree at most d, then the algorithm returns "false" 
with probability at least 0.6. 

Proof of Theorem 13. Suppose G is an a-expander. Then with probability at least 2/3, the number 
of collisions in each of the T repetitions is at most M. When this happens, the collision-counting 
algorithm always returns "false," so we return "true." 

Suppose G is e-far from any (c/ia 2 )-expander of degree at most d. Then with probability at 
most 2/3, the number of collisions is at most M + 1 in at least one of the T repetitions. When this 
happens, the collision-counting algorithm returns "true" with probability at least some constant p. 
We run the collision-counting algorithm t times, where t = log 1 /n_ p j 10. The probability that this 
returns "false" every time is at most (1 — py = 1/10. Thus, with probability at least 9/10, the 
collision-counting algorithm returns "true" at least once, so we return "false." 

The bound on the running time is straightforward. In particular, implementing the £>wise inde- 
pendent random variables bij takes time and space 0(A;logn) = 0((d 2 /a 2 ) poly(log N) \og{d/a)). 
Also, note that the only way we query the graph oracle fo is to evaluate the function /. Evalu- 
ating / requires L = 0((d 2 /a 2 ) log N) queries to fa, and the collision-counting algorithm requires 
0(jVV3+3M poly (log iV)) evaluations of /. □ 
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Algorithm 5 Testing expansion (quantum) 



Given: Oracle fc specifying a graph G with N vertices and max degree d; accuracy parameter e; 
expansion parameter a; running time parameter \x 
for r = 1, . . . ,T for some T = 6(l/e) do 
Pick a random vertex s 

Let if = iV 1 /2+M ) £ = (I6d 2 /a 2 ) log N,n = KL, and fc = 9(L) 

Using Proposition 8, construct probability space £1 and fc-wise independent random variables 
bij taking values in {0, 1, . . . , 2d — 1} (for i = 1, . . . , K and j = 1, . . . , L) 
Choose uj £ Q, uniformly at random 
Let X = {1, ... , K] and Y = {1, . . . , iV} 

Define / : X — > Y as follows: Given i, return the endpoint of the random walk in G that starts 

at s and uses random coin flips (bn(uj), . . . , bn,{oj)) 

Define ROY xY such that (v, v') E R iS v = v' 

Let M = ±iV 2 ^ + -LjSK 1 " 75 ^ 

for a = 1, . . . , t for some t = ©(1) do 

Run Algorithm 4 to test whether there are M + 1 or more collisions 
if Algorithm 4 returns "true" then 

return "false" 
end if 
end for 
end for 
return "true" 



C Quantum lower bound for testing expansion 
C.l Bounding the failure probability and its impact 

Lemma 14. Let M> = 1 + O(^) and I < iV 1 / 4 . The probability that the process generating Pm,i 
fails is at most e -^( N °' 75 2c ). 

Proof. Let Xi be the number of vertices chosen from VJ. Xi is a random variable with expectation 
Epfj] = 7V/Z. Since I < N 1 / 4 , we have E[Xi] > N - 75 . We have to bound the probability that 
Xi > (1 + e)N/l where e = U(l/N c ). By standard Chernoff bounds, 

< e - e 2 E[X,]/3 < e -A r 0-75-2 c/3 ^ 

By the union bound, the probability of the process failing is at most I < iV 1//4 times the probability 
above. □ 

Thus the expectations E[P] for monomials P calculated in Section 3.2 are within a factor 
1 + e ~ n ( N °' 7j 2c ) of the correct ones. To estimate the overall error in the expectation EfP^], we 
also need bounds on the coefficients of various monomials P in the polynomial Pa- (A small error 
times a large coefficient might mean a larger error.) These can be obtained as follows. 

Lemma 15. Let Pa be the polynomial describing the acceptance probability of a quantum algorithm. 
Let P be a monomial of degree k. Then the absolute value of the coefficient of P in the polynomial 
Pa is at most 2 k . 



Pr 



N 
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Proof. Let S be the set of variables that appear in Pa- For a set of variables 5', let x(S') be the 
input in which x% = 1 for all i G S' and x% = for all other i. By inclusion-exclusion, the coefficient 
of P is equal to 

J2(-1)W-WPa(x(S')). (8) 

S'CS 

Since describes the acceptance probability of a quantum algorithm, < Pa(x(S')) < 1. Since 
the sum (8) contains 2 k terms, its magnitude is at most 2 k . □ 

Since our input is described by 0(N 2 ) variables, Pa contains at most A < N 2k monomials 
P of degree k. Therefore, the overall error introduced by the fact that the process generating the 
probability distribution Pm,i may fail is at most 

N 2k 2 k e ~n(N^-2c^ ^ 

Since k < iV 1 / 4 , we have N 2k 2 k = e °(iV 1/2 iogiV)_ If c < Q 125; then jy^logiV = o(iV a75 ~ 2c ) and 
the overall error (9) is of the order e -^( N °' 75 2c ). 

C.2 Expansion properties of subgraphs of unions of random matchings 

Here we prove that graphs drawn from the distribution Pmi (restricted to the I = 1 case) are 
expanders with high probability. As described in Section 3.1, we consider a random graph G on N 
vertices obtained in two steps: 

1. Let G' = (V',E') be a union of c perfect matchings on M vertices; 

2. Let G = (V,E) be the induced subgraph on a random subset of N vertices of G' . 

We follow the proof that a union of 3 random matchings is an expander with high probability, 
as described in [17]. 

Lemma 16. Assume that M < (1 + jja)N for some a > and that a,c satisfy c > 5 and 
ac > 2. Then there exists a > such that a random graph G generated according to the probability 
distribution Pmi is an a-expander with probability 1 — o(l). 

Proof. Let Eij be the event that in graph G, for two sets of vertices U\, U2 with \U\\ = i, | C/2 1 = j, 
U\ n U2 = 0, all the neighbors of vertices v G U\ belong to U\ U XJi. By the union bound, the 
probability that G is not an a-expander is upper bounded by 

snow <»> 



We claim the following: 
Proposition 17. 



Using this claim, we can upper bound (10) by 

'N\ fN\ ( 1 (l + a)i 



^ V i ) \aij \N a N 
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If (1 + a)i < 3N 1 a , we can upper bound the i th term of this sum by 

4 \ f 2 ci 



a 1 1 



N a J "Arlf- 1 ^' 



If ac > 2(1 + a), the sum of all such terms is o(l) because they form a geometric progression with 
common ratio 2 C / N ac / 2 ~ 1 ~ a = o(l). 

Terms with (1 + a)i < 3N 1 ~ a are upper bounded by 

fe_N_\ i feN\ ai / 4(l + a)A t _ / i_\ M 2 " 1 -")* e ( 1+a )* / 4(l + q) \ Cl/2 
\~TJ \ai) V 3iV J ~\n) a ai \ 3 J 

ci/2 



■ (c/2-l-a)i e (l +Q )i ^ 4(1 + a ) 



2 J a ai \ 3 

If c > 5 and a is sufficiently small, this is equal to C % with C = 1 — 17 ( 1) . The sum of C* over all i 
such that (1 + a)i < W 1 -* is C~ n ( Nl ~^ = o(l). □ 

To establish Lemma 16, it remains to prove Proposition 17. 

Proof of Proposition 17. To show this, we first observe that -Ej jC ra is equivalent to all neighbors of 
vertices v G Lq in graph G" belonging to (V' - V) U Lq U C/ 2 . Let m = \ (V - V) U Cq U C/ 2 |. Then 
?n < -§a + (1 + a)^ because there are M — N < -M^ vertices in V' — V and (1 + a)i vertices in 
U\ U U2- We consider one of c matchings. The probability that the first vertex v £ Ui is matched 
to a vertex in (V' — V) U Lq U ^2 is equal to • The probability that the next vertex v £ Lq is 
matched to a vertex in (V — V) U Lq U U2 is equal to ffE§; an d so on. Since \U\\ = i, there must 
be at least i/2 edges incident to a vertex v G Lq. Therefore, the probability that all vertices v £ Lq 
are matched to vertices in (V 1 — V) U Lq U U2 is 

m — 1 m — 3 m — i + 1 /my/ 2 
M-1M-3'"M-i + 1 - VM7 

The probability that this happens for all c matchings is at most (■^■) c ^ 2 - Since M > N, we have 
-jj < 77s- + ■ The desired result follows. □ 



C.3 Lower bound on polynomial degree 

In this section, we prove Lemma 4. We do not believe that this result is new, but it does not appear 
in exactly this form in either [1] or [32]. Aaronson's argument in [1] is weaker in one place, while Shi 
[32] proves a stronger lower bound of ^(n 1 / 3 ) for the collision problem using a different reduction 
to polynomial approximation (which does not seem to be applicable to our graph problem). Thus, 
we include the proof of Lemma 4 for completeness. 
The proof uses the following result of Paturi [29] . 

Theorem 18. Let g(x) be a polynomial such that \g(x)\ < 1 for all integers x £ [^4, B] and 
\d(C) ~ 9([C\ )l ^ c f or some constant c > and some £ £ [A, B\. Then the degree of g(x) is 

n(V(C-^ + i)(5-C + i))- 
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Proof of Lemma 4- We consider the behavior of f(M, I) when we fix M = aN. Similarly to [1], we 
consider two cases: 

Case 1. Suppose \f(aN,l)\ < § for all Z G {1, . . . ,5}. Then g(l) = \ f(aN,l) is a polynomial 
satisfying \g(l)\ < 1 for all / G {1, ... , 5}. We have \g(l) — g(2)\ > |e, so by Theorem 18, the degree 
of g is Cl(y/S). 

Case 2. Suppose \f(aN, Z)| > | for some Z G {1, . . . , 5}. Fix this value of Z, and let Mq be the 
smallest value for which (M , Z) is <5-good. Let Mi be the largest value for which (Mi, I) is 5-good. 
We define g(x) = f(M + xl, I). Then \g(x)\ < 1 for all x G {0, 1, . . . , m} where m = MjjzMi . Also, 
|<7(x )|>|forx = ^^. ' 

We have M = l\\(aN - 2 )] < aN - 5 3 / 2 + Z and Mi = Z|_j(aiV + 5 3 / 2 )\ > aN + 5 3 / 2 - Z. 
Therefore, m > 2l? ? 2 — 2. Since Z < 5, this means that m > 2\/5 — 2. Also, the above bounds 
on M and Mi imply that Mo±Mx G [ a jv - I, aiV + |]. Therefore, aiV G [ ^ /o+ 2 Ml "' , M °+^ 1+ ' ], so 
x G [^1, 2^1]. By Theorem 18, the degree of g must be Q(m) = tl(Vti). □ 

C.4 A partition identity 

Proof of Proposition 5. We want to establish the identity 

C L',L = (11) 

V: L"<L'<L 

for any L, L" with L" < L. We prove the claim by induction on \L"\ — \L\. 

If \L"\ — \L\ = 1, then the sum (11) is just 1 + cyi l. Since the only way to obtain L" by 
successive refinements of L consists of one step L" < L, we have cl",l = —1 and 1 + cl",l = 0. 

For the inductive case, we can express 

cl',l = ~ ^2 cl*m (I 2 ) 

Li : L'<L!<L 

where the term with L\ = L' counts the path L' < L and a general term counts the paths 
L' < ■ • ■ < L\ < L. If we expand each cl^l on the left hand side of (11) using (12), we get 

L':L"<L'<L \Li: L'<Li<L I V M- L" <L'<L ± <L 



Li : L"<L\<L \L': L"<L'<Li 

Each of the terms in brackets on the right hand side is by the inductive assumption. □ 

C.5 Proof of Proposition 6: The final step 

To complete the proof of Proposition 6, it remains to show the following. 

Proposition 19. Let F(L') = S ai (L') . . . S am (L') where ctj > 1 and Y.j( a j - 1) < k - \L\ - 1. 

Then 

c VtL F{L') = Q. (13) 

V: L'<L 
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Proof. First, observe that for ctj = 1, Si(L') = Ylj=i Si=i which is independent of the partition 
L. Therefore, Si(L') is just a multiplicative constant, and it suffices to prove the claim assuming 
Oj > 2 for all i. 

We expand each F(L') in (13) into a linear combination of terms, where each term is a product 
of dijS. Consider one such term. We can write it as 

m on 

n n ( m ) 

1=1 0=1 

where Y\"Li di t a j t is the part that comes from expanding S a ,(L'). 

We would like to show that the sum of all coefficients of (14) in the expansion of (13) is 0. In 
order for a term (14) to appear in the expansion of F(L'), for each I, Ii = . . . ,ii,a t } must be 
contained in one class S of the partition L'. 

We consider two cases. If, for some i, I\ is not contained in one class S of the partition L, then 
// is also not contained in one class of any other L', because all the L's in (13) are refinements of 
L. Then the term (14) does not appear in the expansion of any F(L'). 

Therefore, we can restrict to terms for which each Ii is contained in one class S of the partition 
L. We consider a partition L" defined as follows. Let G be a graph with vertex set {1, . . . , k} and 
edges from i^i to i/^, . . ., for each I. The classes of L" are the connected components of G. In 
other words, L" is the finest partition such that, for all I, all elements of l\ are in the same class. 

If a term (14) appears in the expansion of F(L'), then L" < L' . Therefore, the sum of all the 
coefficients of (14) is 

2 CL '> L - 

L': L"<L'<L 

We claim that L" < L; then this sum is by Proposition 5. Clearly, L" < L, so it remains to prove 
that L 7^ L". 

Observe that the graph G used to define L" has fi = Ylj( a j ~ 1) edges. Therefore, it has at 
least k — fi connected components, i.e., \L"\ >k — ji. Since fi < k— \L\ — 1, we have \L\ < k — fi — 1, 
so L / L". □ 



21 



